CVE-2025-23081: Mediawiki/data transfer Cross-Site Scripting Vulnerability
MODERATECVE-2025-23081 is a MODERATE cross-site scripting vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')) affecting Mediawiki/data transfer libraries in the Packagist ecosystem. The issue involves mediawiki - datatransfer extension cross-site request forgery (csrf) and cross-site scripting (xss). Remediation is available by upgrading affected packages to version 1.39.11, 1.41.3, 1.42.2.
CVE-2025-23081 at a Glance
How to Fix CVE-2025-23081
To remediate this vulnerability, upgrade all affected Mediawiki/data transfer dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade mediawiki/data-transfer to 1.39.11Upgrade mediawiki/data-transfer to 1.41.3Upgrade mediawiki/data-transfer to 1.42.2Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for mediawiki/data-transferHow to Check if You Are Affected
To determine whether your application is affected by CVE-2025-23081, inspect your project dependencies for Mediawiki/data transfer:
inspect dependencies for mediawiki/data-transferAnalyze the terminal output to locate any version of Mediawiki/data transfer in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.39.11), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), where the product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. In Mediawiki/data transfer, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2025-23081 Affected Mediawiki/data transfer Versions
3 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
mediawiki/data-transfer
|
Packagist |
≥ 1.39.0
< 1.39.11
|
1.39.11
|
|
mediawiki/data-transfer
|
Packagist |
≥ 1.41.0
< 1.41.3
|
1.41.3
|
|
mediawiki/data-transfer
|
Packagist |
≥ 1.42.0
< 1.42.2
|
1.42.2
|
References
Frequently Asked Questions
What is CVE-2025-23081?
Which Mediawiki/data transfer versions are affected?
What version fixes CVE-2025-23081?
Is mediawiki/data-transfer affected?
What CWE is associated with CVE-2025-23081?
How can I check Packagist dependencies for CVE-2025-23081?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-c3h5-h73c-29hq",
"modified" : "2025-01-14T20:07:51Z",
"published" : "2025-01-14T18:32:00Z",
"aliases" : [ "CVE-2025-23081" ],
"summary" : "Mediawiki - DataTransfer Extension Cross-Site Request Forgery (CSRF) and Cross-site Scripting (XSS)",
"details" : "Cross-Site Request Forgery (CSRF), Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - DataTransfer Extension allows Cross Site Request Forgery, Cross-Site Scripting (XSS).This issue affects Mediawiki - DataTransfer Extension: from 1.39.X before 1.39.11, from 1.41.X before 1.41.3, from 1.42.X before 1.42.2.",
"severity" : [ {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Packagist",
"name" : "mediawiki/data-transfer"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "1.39.0"
}, {
"fixed" : "1.39.11"
} ]
} ]
}, {
"package" : {
"ecosystem" : "Packagist",
"name" : "mediawiki/data-transfer"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "1.41.0"
}, {
"fixed" : "1.41.3"
} ]
} ]
}, {
"package" : {
"ecosystem" : "Packagist",
"name" : "mediawiki/data-transfer"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "1.42.0"
}, {
"fixed" : "1.42.2"
} ]
} ]
} ],
"references" : [ {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-23081"
}, {
"type" : "WEB",
"url" : "https://gerrit.wikimedia.org/r/c/mediawiki/extensions/DataTransfer/+/1080451"
}, {
"type" : "WEB",
"url" : "https://gerrit.wikimedia.org/r/c/mediawiki/extensions/DataTransfer/+/1093931"
}, {
"type" : "WEB",
"url" : "https://gerrit.wikimedia.org/r/q/I5e1538a3bf66378810f905834c05626e1d2c82f0"
}, {
"type" : "WEB",
"url" : "https://gerrit.wikimedia.org/r/q/I773c616db781d2f3f30893ad01ef503bf251a2b3"
}, {
"type" : "WEB",
"url" : "https://gerrit.wikimedia.org/r/q/I7c9de4c8dcdb3276ba923c6bc7c8eef3531324c7"
}, {
"type" : "WEB",
"url" : "https://gerrit.wikimedia.org/r/q/I9223c31f02f31f1e06e1a8cddf7d539cc8d3a3d9"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/wikimedia/mediawiki-extensions-DataTransfer"
}, {
"type" : "WEB",
"url" : "https://phabricator.wikimedia.org/T379749"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-79" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2025-01-14T20:07:51Z",
"nvd_published_at" : "2025-01-14T17:15:21Z"
}
}